Description
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ghostscript | 10.08.0~dfsg-1 | — |
| Debian 13 | ghostscript | 10.05.1~dfsg-1+deb13u3 | — |
| Debian 12 | ghostscript | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ghostscript | 10.07.1~dfsg-1ubuntu2.1 | USN-8949-1 |
| Ubuntu 26.04 LTS | ghostscript | 10.06.0~dfsg-3ubuntu1.2 | USN-8949-1 |
| Ubuntu 24.04 LTS | ghostscript | 10.02.1~dfsg1-0ubuntu7.10 | USN-8949-1 |
| Ubuntu 22.04 LTS | ghostscript | 9.55.0~dfsg1-0ubuntu5.15 | USN-8949-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ghostscript | 9.50~dfsg-5ubuntu4.15+esm3 | USN-8949-1 |
| Ubuntu Pro 18.04 LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.18.04.18+esm6 | USN-8949-1 |
| Ubuntu Pro 16.04 LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.16.04.14+esm11 | USN-8949-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libgs +1 | 10.02.1-16.el10_2.3 | RHSA-2026:83551 |
| RHEL 9 | libgs +1 | 9.54.0-19.el9_8.3 | RHSA-2026:83553 |
| RHEL 8 | libgs +1 | 9.27-19.el8_10 | RHSA-2026:83552 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libgs +6 | 10.02.1-16.el10_2.3 | ALSA-2026:83551 |
| AlmaLinux 9 | libgs +7 | 9.54.0-19.el9_8.3 | ALSA-2026:83553 |
| AlmaLinux 8 | libgs +7 | 9.27-19.el8_10 | ALSA-2026:83552 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ghostscript | 10.02.1-16.el10_2.3 | RLSA-2026:83551 |
| Rocky Linux 9 | ghostscript | 9.54.0-19.el9_8.3 | RLSA-2026:83553 |
| Rocky Linux 8 | ghostscript | 9.27-19.el8_10 | RLSA-2026:83552 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES 15 SP6 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES 15 SP5 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES 15 SP4 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES 12 SP5 | ghostscript | 9.52-23.103.1 | SUSE-SU-2026:5094-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | ghostscript | 10.08.0-160000.2.1 | SUSE-SU-2026:24468-1 |
| SLES for SAP 15 SP6 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES for SAP 15 SP5 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES for SAP 15 SP4 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLES 16.0 | ghostscript | 10.08.0-160000.2.1 | SUSE-SU-2026:24468-1 |
| SLE HPC 15 SP5 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
| SLE HPC 15 SP4 | ghostscript | 9.52-150000.217.1 | SUSE-SU-2026:5039-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ghostscript | 10.08.0-2.1 | openSUSE-SU-2026:12128-1 |
| openSUSE Leap 16.0 | ghostscript | 10.08.0-160000.2.1 | openSUSE-SU-2026:22176-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libgs +8 | 9.56.1-7.amzn2023.0.20 | ALAS2023-2026-3294 |
| Amazon Linux 2 | libgs +5 | 9.54.0-9.amzn2.0.14 | ALAS2-2026-4034 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libgs +6 | 10.02.1-16.el10_2.3 | ELSA-2026-83551 |
| Oracle Linux 9 | libgs +7 | 9.54.0-19.el9_8.3 | ELSA-2026-83553 |
| Oracle Linux 8 | libgs +7 | 9.27-19.el8_10 | ELSA-2026-83552 |
Advisories 21
- SUSE-SU-2026:5094-1 Security update for ghostscript SUSE / openSUSE Security Updates · Nov 4, 2026
- WID-SEC-2026-3777 Ghostscript: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 4, 2026
- SUSE-SU-2026:24468-1 Security update for ghostscript SUSE / openSUSE Security Updates · Nov 4, 2026
- SUSE-SU-2026:5039-1 Security update for ghostscript SUSE / openSUSE Security Updates · Nov 3, 2026
- openSUSE-SU-2026:22176-1 Security update for ghostscript SUSE / openSUSE Security Updates · Nov 1, 2026
- ALSA-2026:83553 Important: ghostscript security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:83551 Important: ghostscript security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:83552 Important: ghostscript security update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3294 Important: ghostscript security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2-2026-4034 Important: ghostscript security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- USN-8949-1 ghostscript vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- RHSA-2026:83553 Red Hat Security Advisory: ghostscript security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83552 Red Hat Security Advisory: ghostscript security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83551 Red Hat Security Advisory: ghostscript security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:83551 Important: ghostscript security update Rocky Linux Security Advisories · Oct 16, 2026
- RLSA-2026:83553 Important: ghostscript security update Rocky Linux Security Advisories · Oct 16, 2026
- RLSA-2026:83552 Important: ghostscript security update Rocky Linux Security Advisories · Oct 16, 2026
- openSUSE-SU-2026:12128-1 ghostscript-10.08.0-2.1 on GA media SUSE / openSUSE Security Updates · Oct 15, 2026
- ELSA-2026-83551 Important: ghostscript security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
- ELSA-2026-83553 Important: ghostscript security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
- ELSA-2026-83552 Important: ghostscript security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
References
- RHSA-2026:83551 vendor-advisory
- RHSA-2026:83552 vendor-advisory
- RHSA-2026:83553 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-101258 vdb-entry
- RHBZ#2542396 issue-tracking
- https://github.com/v12-security/pocs/tree/main/ghostscript